Critical severity · published Jun 9, 2026
CVE-2026-27671
Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploits logical errors in memory management, leading to memory corruption. This could lead to a high impact on the confidentiality, integrity, and availability of the application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SN
SAP NetWeaver AS ABAP and ABAP Platform · SAP_SE
KRNL64NUC 7.22; 7.22EXT; KRNL64UC 7.22; 722EXT; 7.53; KERNEL 7.22; +7 more · source: vendor
Affected product
SN
SAP NetWeaver AS ABAP and ABAP Platform
SAP_SE
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-27671
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-27671
me.sap.com
https://me.sap.com/notes/3717897
url.sap
https://url.sap/sapsecuritypatchday
More from SAP NetWeaver AS ABAP and ABAP Platform
9.9
CVE-2026-44748
XML Signature Wrapping in SAML Authentication in SAP NetWeaver AS ABAP and ABAP Platform
8.8
CVE-2026-23687
XML Signature Wrapping in SAP NetWeaver AS ABAP and ABAP Platform
7.1
CVE-2026-44751
Missing Authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform